The AI Brief

Vol. I · No. 150 · Thursday, October 22, 2026

Today's brief:

  • DeepSeek closes a $15 billion round backed by Tencent and CATL, one of the largest AI financings China has ever produced, signaling the Hangzhou lab is done operating lean.
  • Meta raises its 2026 AI infrastructure floor to $135 billion after a Q3 revenue beat, and creates a non-voting Class C share to fund the buildout without diluting Mark Zuckerberg's control.
  • AI-discovered critical PHP flaws forced emergency patches and website shutdowns worldwide, demonstrating that agent-led vulnerability research now moves faster than coordinated disclosure can follow.
  • OpenAI brings GPT-6 Astra, Sol, and Luna to Google Cloud Model Garden, making Google the only hyperscaler selling all three closed-source frontier model families side by side.
  • Multiple Google DeepMind researchers resign over the lab's Pentagon and Israel military contracts, the first organized talent departure over AI weaponization since Project Maven in 2018.
  • Also today: Anthropic is expected to publicly file its S-1 prospectus as early as Friday, clearing the last procedural barrier to a November listing; some investors have trimmed their valuation target from $2 trillion to around $1.5 trillion (first covered Vol. I, No. 148).

DeepSeek closes $15 billion round, doubling its fundraising target

Why it matters
DeepSeek built its reputation on doing more with less; a $15 billion round backed by battery giant CATL and Tencent ends that posture and positions Hangzhou alongside the US frontier labs in capital terms, even as it remains blocked from Nvidia's most advanced chips under export controls.
What's at stake
For operators choosing between US and Chinese frontier models, DeepSeek's move from founder-funded frugality to institutional-scale capital tests whether its low-cost pricing survives the funding shift, or whether a better-resourced DeepSeek eventually converges toward US pricing floors as infrastructure costs rise.
Detail

DeepSeek, the Hangzhou-based AI lab led by founder Liang Wenfeng, has raised approximately 100 billion yuan (roughly $15 billion) in its latest funding round, Bloomberg and Reuters reported on October 21. Battery maker Contemporary Amperex Technology (CATL) and internet conglomerate Tencent Holdings were among the largest investors, according to people familiar with the matter. The round's financial details have not been publicly disclosed by the company.

DeepSeek raised its target at least twice during negotiations, beginning at 50 billion yuan, then 80 billion yuan, before settling at 100 billion yuan, a sign of investor demand that exceeded initial expectations. The financing ranks among China's largest-ever AI fundraising rounds. It follows a May 2026 Series A at $7 billion and a post-money valuation of $52 billion. The round is expected to close in the coming days, though terms could still change.

DeepSeek plans to direct proceeds toward data center expansion and open-source AI development. The company's annualized revenue run rate crossed $1 billion in September, after CEO Liang raised API prices 2.3 to 4.5 times without losing customers. Bloomberg also reported that DeepSeek hired CITIC Securities in September to prepare for a potential STAR Market IPO. The new capital substantially narrows the resource gap with OpenAI and Anthropic, each of which has now raised over $100 billion, though US chip export controls continue to limit DeepSeek's access to Nvidia's most advanced accelerators.


$145B
Meta's full-year 2026 AI infrastructure spending ceiling, after raising the floor to $135 billion in Q3 earnings

Meta lifts its AI spend floor and creates a new share class to fund it without ceding control

Why it matters
Meta CEO Mark Zuckerberg's Q3 earnings report commits the company to AI infrastructure spending that is roughly double its 2025 outlay, and the simultaneous creation of a non-voting Class C share class shows the company intends to keep raising equity capital for the buildout without diluting Zuckerberg's voting position.
What's at stake
For most operators, this is context, not a decision. For those pricing AI infrastructure budgets, component costs and enterprise GPU availability: Meta's updated $135 to $145 billion guidance, alongside the five largest US hyperscalers collectively targeting $660 to $690 billion in 2026 capex, is the demand signal that will set DDR5 and high-end GPU prices into 2027.
Detail

Meta reported third-quarter 2026 revenue of $64.6 billion, up 26% year over year and ahead of consensus estimates of roughly $63.4 billion. The company raised the floor of its full-year 2026 capital expenditure guidance to $135 billion from $130 billion, leaving the $145 billion ceiling unchanged. This is the fourth capex increase in 2026; Meta entered the year guiding to $115 to $135 billion. The money is going primarily toward AI infrastructure, specifically data centers, custom silicon, and energy deals supporting Muse, its consumer AI agent, and its frontier model training programs.

Alongside the earnings, Meta announced a 2-for-1 stock split under which every existing Class A shareholder receives one new non-voting Class C share. The structure lets Meta raise equity capital for the AI buildout without weakening Zuckerberg's voting control. Wall Street consensus for Meta's 2027 capex now sits around $196 billion, suggesting the investment cycle is still accelerating. Meta's Q3 per-share earnings of $3.83 beat expectations by a wide margin. The company guided Q4 revenue above consensus.


AI finds 14-year-old PHP flaw that forced emergency patches across the internet

Why it matters
The PHP2Shell disclosures show that AI-assisted vulnerability research now moves fast enough to find critical flaws in heavily audited, decades-old codebases before human researchers do, compressing the window between discovery and attacker exploitation to the point where coordinated two-month disclosure timelines feel long.
What's at stake
Any operator running PHP-based infrastructure, including WordPress, Drupal, or Joomla deployments, should verify that PHP security releases from October 21 are applied; the same AI-assisted discovery methods available to defenders are equally available to attackers who did not participate in coordinated disclosure.
Decode
CVSS 9.2 = Common Vulnerability Scoring System score of 9.2 out of 10, classified as "critical." A 9.2 indicates an attacker can exploit the flaw remotely with no authentication and no user interaction required. At that score, major cloud providers typically mandate emergency patching timelines of 24 to 72 hours.

Unauthenticated RCE (remote code execution) = an attacker can run arbitrary code on a target server without needing a password or account. On a web server, that means full control of the machine and everything it can reach on the internal network.
Detail

PHP shipped four security releases on October 21, 2026, fixing two critical flaws: CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS v4.0. Researchers at security firm Calif, working under OpenAI's Patch the Planet program, discovered one flaw on August 1 using GPT-5.6 Sol. Wiz independently discovered and reported both vulnerabilities. The disclosed flaw in CVE-2026-109618 had been present in PHP for approximately 14 years; a limited version was found in 2024 and judged insignificant at the time. CVE-2026-109619 involves a use-after-free condition in PHP's worker process request handling.

Researchers demonstrated pre-authentication remote code execution against WordPress, Drupal, and Joomla, and separately demonstrated Heartbleed-style memory disclosure against any PHP application. Cloudflare began deploying web application firewall protections in early October. CERT-EU says PHP maintainers pre-announced the security release on October 20, with patches shipping at 13:30 UTC on October 21. The PHP Foundation's own advisory reads: "All PHP users are strongly encouraged to update immediately."

OpenAI framed the disclosure as the first major output of Patch the Planet, a coordinated-disclosure program launched June 22, 2026, and committed $1 billion in subsidized access to its Daybreak cyber models for resource-constrained organizations. OpenAI also announced an international vulnerability-response framework on October 21, proposing to extend the PHP coordination model to future AI-discovered flaws. The episode represents the first time an AI-assisted program publicly claimed credit for discovering a critical vulnerability in a runtime-level open-source project, as distinct from application-layer bugs.

OpenAI: Patch the Planet (primary)/ Fortune: AI helped discover the PHP vulnerability/ SMB Tech: Industry reacts to PHP patching emergency/ CaveatOpenAI's Patch the Planet disclosure is a vendor-published account; Wiz and CERT-EU provide independent corroboration of the technical findings.

OpenAI lands on Google Cloud, completing all three major hyperscalers

Why it matters
Google Cloud becomes the only hyperscaler now offering Gemini, Claude, and GPT-6 side by side in a single catalog, which restructures enterprise AI procurement from a choice of vendor to a choice of model within a single cloud bill, eliminating the contract-switching cost that previously kept enterprises locked to a single frontier family.
What's at stake
Enterprises already on Google Cloud can now route existing cloud spending commitments toward GPT-6 Astra without a new vendor contract; the direct beneficiary of multi-model catalogs is the platform layer, not any single model provider, and Google Cloud captures distribution margin regardless of which frontier model wins the task.
Detail

OpenAI and Google Cloud announced on October 21, 2026 that GPT-6 Astra, GPT-6.1 Sol, and GPT-6 Luna, plus OpenAI's Codex agentic coding workflows, are entering private preview in Google Cloud's Model Garden. General availability is planned in the coming weeks. Purchases will be routed through Google Cloud Marketplace and count against customers' existing cloud spending commitments. OpenAI's announcement stated explicitly that "Microsoft remains OpenAI's primary cloud partner," with Microsoft's exclusive license having expired in April 2026. Oracle customers received access in June 2026.

The deal also extends to Google's Antigravity AI development environment and the Gemini Agent orchestration layer. Google Cloud frames the arrangement as proof of its model-neutral ambitions: the catalog already includes more than 200 first-party, third-party, and open-weight models. For OpenAI, the Google Cloud channel adds distribution reach among enterprise buyers who have resisted re-platforming to Azure or the OpenAI API. The partnership mirrors an earlier OpenAI expansion onto Amazon Web Services earlier in 2026. Neither company published Google-side prices; OpenAI's own API lists Sol at $2.00 per million input tokens.


Google DeepMind researchers resign over Pentagon and Israel military AI contracts

Why it matters
The DeepMind departures are the most publicly documented AI lab resignations over military use since Google's 2018 Project Maven walkout, and they follow Google's April 2026 classified Pentagon contract announcement, suggesting that as AI labs take on defense work, talent friction over military applications is shifting from occasional protest to a structural retention variable.
What's at stake
For most operators, this is context, not a decision. For AI labs and enterprise buyers evaluating research talent pipelines: DeepMind researcher Andreas Kirsch's public statement that Google's governance is "not sufficient or meaningful enough to deploy AI safely in military and classified settings" is the kind of named, on-record critique that shapes future hiring conversations, not just headlines.
Detail

Research engineer Sofia Liguori resigned from Google DeepMind this week after three years at the company, citing the lab's growing involvement with US and Israeli defense forces. Liguori joined in 2023 to work on AI for power grid optimization. After Google announced a classified military AI contract with the Pentagon in April 2026, she staged a personal sick-out using leave time, and ultimately resigned. In an internal letter, she urged colleagues to "stay human." Andreas Kirsch, an AI researcher, had separately resigned from DeepMind earlier in October over the same concerns. The BBC spoke with several current and former employees on the record, per its October 21 report.

Kirsch told the BBC that Google's governance and oversight are "not sufficient or meaningful enough to deploy AI safely and responsibly in military and classified settings." The departing researchers expressed concern specifically about Google's Project Nimbus contract, a joint arrangement with Amazon that furnishes Israel's military and top weapons manufacturers with advanced AI tools. They cited this year's expanded Pentagon deal as materially increasing the scope of military AI use, beyond what earlier contracts permitted. Google said publicly that its defense contracts go through reviews for compliance with its AI principles and acceptable-use policies.

The resignations echo the 2018 Project Maven episode, when roughly a dozen Google employees quit after the company won a Pentagon contract to analyze drone footage using AI, ultimately prompting Google to decline renewal. In 2026, the contracts in question are substantially broader in scope and more deeply integrated into DeepMind's core research capacity. No equivalent public departures over military AI have yet been reported at OpenAI, Anthropic, or Meta, though all four labs now hold some form of US defense relationship.